# The crime story of how North Korean IT workers get hired in 2026 and turn a laptop farm into a salary pipeline

The crime story of North Korean IT workers who pass interviews, take American salaries and run laptop farms, plus the Arizona host sentenced to 102 months.

Source: https://xiaozhangyu.top/the-crime-story/ · based on the channel [Max Crime](https://www.youtube.com/channel/UCkXbEnN10DV7a_JZf2jb1oQ) · Video: [Company Has No Idea Its New Hire Is a North Korean Hacker (crime story)](https://www.youtube.com/watch?v=TJ4S-aEeyDw) · 2026-10-29

![The crime story of how North Korean IT workers get hired in 2026 and turn a laptop farm into a salary pipeline](https://xiaozhangyu.top/the-crime-story/the-crime-story.webp)

## Key takeaways

- KnowBe4, a company that trains staff to spot fakes, hired a North Korean IT worker who passed four video interviews and a background check using an AI-altered photo and a real American's name.
- Christina Chapman of Arizona kept more than ninety work laptops on wire shelves in her home, each tagged with a company and a stolen identity.
- Chapman was sentenced in July 2025 to 102 months in federal prison; she kept about $177,000 while more than $17 million flowed through her operation.
- The FBI and Justice Department have warned that DPRK IT workers funnel wages back to North Korean weapons programs.
- Microsoft tracks the related infrastructure as Jasper Sleet, and the FBI's IC3 issued a public service announcement on the scheme in January 2025.

The crime story at the center of this case is simple to state and hard to believe: a company that trains other businesses to detect fraud hired a North Korean IT worker, paying him a real American salary for months. He cleared four video interviews, a background check and an AI-touched application photo, and the first sign of trouble came when his work laptop began loading malware the moment it was switched on. The scheme behind that hire is now one of the fastest-growing remote-work frauds in the United States, and it depends on people like Christina Chapman, who prosecutors say ran a laptop farm from her Arizona home.

## What the crime story actually involves

North Korea's IT worker scheme is a remote-employment fraud run at industrial scale. Operators apply for ordinary software and engineering jobs at American companies, using stolen identities, fabricated résumés and, increasingly, AI-generated faces for interviews. Once hired, the worker never touches the machine: a middleman in the United States receives the company laptop, plugs it into a home network and lets the overseas operator connect remotely.

The money matters more than the job. According to the Justice Department, DPRK IT workers have generated millions of dollars in wages that flow back to North Korea and help fund its weapons programs. The FBI's IC3 warned in a January 2025 public service announcement that companies hiring remote IT staff are prime targets, and Microsoft Threat Intelligence tracks the supporting infrastructure under the name Jasper Sleet.

## The hire that should never have happened

KnowBe4, a Florida company whose entire business is security-awareness training, disclosed in July 2024 that it had hired a North Korean operative as a software engineer. The application looked ordinary. The photo was AI-altered. The name belonged to a real American. The candidate sat through four video interviews, and the background check came back clean because the identity was genuine — it just did not belong to the person on the call.

The tell came after onboarding. The company shipped a Mac workstation to the new hire, and almost immediately its endpoint detection software flagged unusual activity: the machine was loading malware, apparently as part of an effort to establish remote access. KnowBe4's security team isolated the device, investigated and confirmed the worker's true location. The company shared the findings publicly and with law enforcement, and the episode became a case study in why identity verification has to go beyond a résumé and a smiling face on Zoom.

## How the laptop farm worked

A laptop farm solves the practical problem in the scheme: American companies ship equipment to American addresses, and someone has to be there to receive it. Prosecutors described Christina Chapman's home in Arizona as exactly that kind of facility.

1. Recruiters connected to the DPRK IT worker network sent laptops to Chapman's address under stolen American names.
2. The machines were stored on wire shelving, each tagged with the company it belonged to and the identity it was registered to.
3. Chapman connected the devices to her home internet so the overseas workers could log in from North Korea and appear to be sitting in Arizona.
4. Paychecks were routed through accounts tied to the stolen identities, with a cut going to Chapman and the rest moving onward.

The scale was large. More than ninety laptops passed through the house, and prosecutors said more than $17 million in wages flowed through the operation. Chapman herself kept roughly $177,000, according to the government's case. She maintained that she did not know who she was really working for; prosecutors pointed to her own messages, which they said showed otherwise. In July 2025 she was sentenced to 102 months in federal prison.

## Why background checks and video calls fail

The uncomfortable lesson of this crime story is that the standard hiring safeguards were never designed to stop it. A background check verifies that a Social Security number, address and credit history exist — and in these cases they do, because the identity is stolen from a real person. A video interview verifies that someone can answer questions on camera, and AI face-swapping tools now make that person look like the photo on the résumé.

Remote work removes the last physical checkpoint. Nobody meets the new hire at a desk, nobody notices that the person in the standup meeting never turns on the camera, and nobody wonders why a junior developer insists on using a company laptop in a specific location. Security teams have begun flagging patterns instead: a home IP address shared by several employees, a device that connects from one city and authenticates from another, or a new hire whose VPN traffic resolves to an unexpected country.

## Questions companies and workers keep asking

The case has generated a predictable set of concerns from people who hire remotely or work alongside contractors. The most common is whether a small business can realistically screen for this. The answer is partly yes: verifying identity in person or through a trusted notary, checking that the address on a tax form matches the address where equipment is shipped, and requiring camera-on interviews with live follow-up questions all raise the cost of the fraud.

The second concern is scale. Chapman's operation was not a single rogue hire; it was a service that supplied American addresses, equipment handling and banking access to multiple overseas workers at once. Investigators have since searched other homes and seized more laptops, suggesting the Arizona case was one node in a wider network rather than an anomaly. For employers, the practical takeaway is that a clean background check is not the same as a verified human being.

## What the sentencing signals

Chapman's 102-month sentence is the clearest signal yet that the Justice Department treats laptop farms as serious criminal infrastructure, not as a minor immigration or fraud matter. The charge set in these cases typically includes conspiracy to commit wire fraud and identity theft, and the government has emphasized the national-security dimension: wages earned by DPRK IT workers are not simply stolen from American payrolls, they are routed to a sanctioned state.

The case also puts pressure on the companies that were victimized. None of the employers were named in the Justice Department's releases, but each one shipped a laptop, paid a salary and, in some cases, gave network access to someone sitting thousands of miles away. The cost of that access is still being counted.

## The bottom line on this crime story

North Korean IT workers do not need to hack their way into a company when they can simply apply, interview and get hired. The scheme works because it exploits ordinary trust: a résumé, a video call, a background check and a mailing address. Chapman's laptop farm turned that trust into a business, and her sentence shows what happens when the FBI traces the equipment back to a suburban home. The full breakdown of the case, including the night of the alert reconstructed minute by minute, comes from Max Crime, whose documentary assembles the Justice Department releases, the FBI advisory, KnowBe4's own account and reporting from Bloomberg, NBC News, CNN, CBS News and The Wall Street Journal.

## Questions & answers

**How did a North Korean IT worker pass a background check at a security company?**

The identity was real; it belonged to an American citizen whose personal details had been stolen. A background check confirms that a name, Social Security number and address exist and are consistent, not that the person on the video call is that individual. The application photo was also altered with AI, so the face matched the documents.

**What is a laptop farm and why is it needed?**

A laptop farm is a location in the United States where company-issued computers are received and kept connected to the internet so overseas workers can log in remotely. It exists because employers ship equipment to domestic addresses and track where devices connect from. In the Arizona case, more than ninety laptops were stored on wire shelves, each tagged with a company and a stolen name.

**How much money moved through Christina Chapman's operation?**

Prosecutors said more than $17 million in wages flowed through her house, while Chapman personally kept about $177,000. She was sentenced in July 2025 to 102 months in federal prison. She claimed she did not know who she was working for, but the government cited her own messages as evidence she did.

**What warning signs should a company watch for when hiring remotely?**

Red flags include a candidate who refuses to appear on camera, an address that does not match where the equipment is shipped, several employees authenticating from the same home IP address, and a device that connects from one city while the worker claims to be in another. Verifying identity in person or through a notary, and asking live follow-up questions in interviews, raises the cost of the fraud.